Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Ladislav Hagara <ladislav.hagara AT unob.cz>
  • Cc: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors
  • Date: Thu, 08 Sep 2005 21:43:07 +0200



Yep I like this idea. Why not always using a hash, and adding vendor
signing when it's available ?

Please re-read the thread and you'll know why.


Eric, I have the same problem. I really don't understand "Why not always using a hash, and adding vendor
signing when it's available ?". These threads are only very long but no discussions. Some of you don't want to listen. It was decided some time before this discussion. Some of you arranged it probably on irc or personally and we other have to just accommodate you.

My kindred spirit. :-)

Personally I would ban smgl's developers gpg signs. There are/will be
only problems with them.
I would like us to use only hashes (probably created by gpg --print-md).
Of course "adding vendor signing when it's available" is great for our
users.

We're not banning the better technological approach, but, after the
poll I conducted, we are going to continue to support hashsums for the
foreseeable future with `gpg --print-md`.

Yea, according to several of you it is better technological approach. But I know developers who don't agree with it.
What it the result of that poll? Who agree? Who don't agree?
It is the same as our leaders polls. I know only "and winner is ...".
Personally I would like to know who voted who. What was the difference. I would like to have this process more transparent.

# cast xyz
Checking xyz's developers gpg signing .... OK.
Checking Source Mage hash ... OK
...

Why not just one?

It was written. As you wrote "Please re-read the thread and you'll know why."
We know nothing about application developer's signing policy. Their web site can be cracker, their private key can be stolen.
Lets go to download new repackage of xyz with good signature with "rm -rf /*". Our hash can help to prevent it.

What is the result of our discussion? What is the result of GPG signing
poll?

Whoops, I responded as I read, sorry. Answer is above. ;)

Yea, it is very transparent. Thank you.

Short answer: We will continue to support hashsums as well as GPG.

How long? To next accidental irc meeting?

Some last changes are quite annoying for me. Changes in perforce (subject and sender, your sweet diffs). This "discussion" about gpg signing. Refusing of Benoit's work. Do you really think http://www.sourcemage.org/developers looks/is better than http://wiki.sourcemage.org/index.php?page=The+Source+Mage+Developers ?

On the other side, I can only thank you all for developing this great distro.

--
Ladislav Hagara
Source Mage GNU/Linux Developer




Archive powered by MHonArc 2.6.24.

Top of Page